acme

The OAuth2Client library has been deprecated by Google since 2018, and there is a replacement library google-auth.

https://github.com/certbot/certbot/blob/8b610239bfcf7aac06f6e36d09a5abba3ba87047/certbot-dns-google/certbot_dns_google/_internal/dns_google.py#L8

What would you like to be added

I'd like to have the option to not have the HSM pin stored in a configuration file, but instead be required to be entered manually by an operator each time the CA is started.

Why this is needed

Having HSM pins sitting on the file system weakens the security in cases of hardware being stolen.

In theory if the PIN is not known then stealing a server a

If you create a custom ICertificateAuthorityConfiguration and pass it to say a step-ca authority, with a custom port in the URL the FileSystemAccountStore tries to put the port in the directory name and fails.

Can we change from AuthorityUri to Host?

As @rjkroege mentioned in rjkroege/edwood#288 tokenizing the results of the getarg function would allow for more robust parsing of the given arguments.